Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-5309 | form-vibes (WordPress plugin) | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due t | medium | 5.4 | 0% |
| CVE-2025-4370 | brizy (WordPress plugin) | The Brizy – Page Builder plugin for WordPress is vulnerable to limited file uploads due to missing authorization on process_external_asset_u | medium | 5.3 | 0% |
| CVE-2025-2104 | pagelayer (WordPress plugin) | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insuf | medium | 4.3 | 0% |
| CVE-2024-1809 | wp-analytify (WordPress plugin) | The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access | medium | 5.4 | 0% |
| CVE-2025-4520 | uncanny-automator (WordPress plugin) | The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple | medium | 5.4 | 0% |
| CVE-2024-13651 | unusedcss (WordPress plugin) | The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c | medium | 4.3 | 0% |
| CVE-2023-6748 | custom-field-template (WordPress plugin) | The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 v | medium | 4.3 | 0% |
| CVE-2022-25768 | mautic/core, mautic/core-lib | Mautic vulnerable to Improper Access Control in UI upgrade process | high | 7.0 | 0% |
| CVE-2024-1851 | affiliate-toolkit-starter (WordPress plugin) | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability che | medium | 6.3 | 0% |
| CVE-2025-11228 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 5.3 | 0% |
| CVE-2025-12877 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data du | medium | 5.3 | 0% |
| CVE-2024-8632 | kb-support (WordPress plugin) | The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data d | medium | 6.5 | 0% |
| CVE-2022-3451 | product-stock-manager (WordPress plugin) | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowin | medium | 4.3 | 0% |
| CVE-2022-4124 | popup-manager (WordPress plugin) | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthe | medium | 4.3 | 0% |
| CVE-2026-34737 | wwbn/avideo | AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug | medium | 6.5 | 0% |
| CVE-2024-6750 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability | high | 7.3 | 0% |
| CVE-2023-6798 | feedzy-rss-feeds (WordPress plugin) | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unaut | medium | 5.4 | 0% |
| CVE-2026-44585 | paymenter/paymenter | Paymenter has broken object level authorization via service reference manipulation on ticket creation | medium | 5.4 | 0% |
| CVE-2025-2289 | zegen (WordPress theme) | The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJA | medium | 4.3 | 0% |
| CVE-2025-3863 | post-carousel-slider-for-elementor (WordPress plugin) | The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the | medium | 4.3 | 0% |
| CVE-2024-10294 | ce21-suite (WordPress plugin) | The CE21 Suite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ce21_single | medium | 6.5 | 0% |
| CVE-2024-7491 | woocommerce-products-filter (WordPress plugin) | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versi | medium | 5.3 | 0% |
| CVE-2024-32792 | hummingbird (WordPress plugin) | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects | medium | 4.3 | 0% |
| CVE-2025-1507 | googleanalytics (WordPress plugin) | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi | medium | 5.3 | 0% |
| CVE-2022-4872 | chained-products (WordPress plugin) | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option | medium | 4.3 | 0% |
| CVE-2026-55542 | snipe/snipe-it | Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL | low | 0.0 | 0% |
| CVE-2023-7288 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capabili | medium | 5.4 | 0% |
| CVE-2023-7289 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability | medium | 5.4 | 0% |
| CVE-2023-6491 | strong-testimonials (WordPress plugin) | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the w | medium | 4.3 | 0% |
| CVE-2023-7292 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing cap | medium | 4.3 | 0% |
| CVE-2024-10614 | customer-reviews-woocommerce (WordPress plugin) | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the canc | medium | 4.3 | 0% |
| CVE-2024-11911 | wp-crowdfunding (WordPress plugin) | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_ | medium | 4.3 | 0% |
| CVE-2024-12855 | adforest (WordPress theme) | The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX action | medium | 4.3 | 0% |
| CVE-2024-1376 | event-post (WordPress plugin) | The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdat | medium | 4.3 | 0% |
| CVE-2024-4088 | attire-blocks (WordPress plugin) | The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missi | medium | 4.3 | 0% |
| CVE-2024-4661 | wp-reset (WordPress plugin) | The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax func | medium | 4.3 | 0% |
| CVE-2024-5860 | tickera-event-ticketing-system (WordPress plugin) | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-6883 | event-espresso-decaf (WordPress plugin) | The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings m | medium | 4.3 | 0% |
| CVE-2024-8437 | wp-easy-gallery (WordPress plugin) | The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check o | medium | 4.3 | 0% |
| CVE-2024-5607 | ninja-gdpr-compliance (WordPress plugin) | The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.4 | 0% |
| CVE-2024-12879 | wpot (WordPress plugin) | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2025-4522 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via | medium | 6.5 | 0% |
| CVE-2024-2544 | popup-builder (WordPress plugin) | The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check | high | 7.4 | 0% |
| CVE-2024-9628 | wps-telegram-chat (WordPress plugin) | The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability c | medium | 6.3 | 0% |
| CVE-2024-9630 | wps-telegram-chat (WordPress plugin) | The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages i | medium | 5.4 | 0% |
| CVE-2026-49288 | statamic/cms | Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources | medium | 4.3 | 0% |
| CVE-2026-50550 | snipe/snipe-it | Snipe-IT has a 2FA reset privilege bypass | medium | 5.8 | 0% |
| CVE-2026-28424 | statamic/cms | Statamic's missing authorization allows access to email addresses | medium | 6.5 | 0% |
| CVE-2023-5611 | seraphinite-accelerator (WordPress plugin) | The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its set | medium | 5.3 | 0% |
| CVE-2025-48013 | drupal/quick_node_block | This module provides a block to easily display a rendered node. Access to the rendered node isn't validated before rend | medium | 5.3 | 0% |